Privacy Policy

This Privacy Policy explains how POLYGLOT DESIGN™ (“POLYGLOT,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects personal data when you:

• visit POLYGLOT DESIGN;
• purchase products or services through our online store;
• communicate or work with us;
• use the client portal at POLYGLOT Client Portal;
• connect an Instagram professional account to our social media analytics service; or
• otherwise use a product or service that links to this Privacy Policy.

POLYGLOT DESIGN™ is based in the Kingdom of Bahrain. We process personal data in accordance with Bahrain’s Personal Data Protection Law, Law No. 30 of 2018, and other laws that apply to our activities.

If you have questions about this Privacy Policy or how we handle personal data, contact us at info@polyglotdesign.com.

1. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed through:

• our public website;
• our online store;
• our client portal;
• client onboarding and project delivery;
• quotations, invoices, orders, submissions, approvals, and downloads;
• Instagram professional-account connections;
• Instagram analytics, dashboards, reports, and deterministic insights;
• support, security, and operational communications.

This Privacy Policy does not govern the independent privacy practices of third-party websites or services that you access through links from POLYGLOT.

2. Our role when processing data

Depending on the service and the circumstances, POLYGLOT may act as:

• a data controller when we determine why and how personal data is processed, such as website, store, account, billing, security, and business-administration data; or
• a service provider processing information on behalf of a client organization, such as certain project materials and Instagram analytics used to provide contracted reporting services.

Where a client organization determines the purposes for which information is processed, questions or requests may need to be directed to that organization. We will assist the organization where reasonably required and permitted.

3. Personal data we collect

3.1 Website and online-store data

We may collect:

• your name;
• email address;
• telephone number;
• account credentials, with passwords stored in hashed form;
• shipping and billing addresses;
• order and purchase history;
• quotation, invoice, and payment status information;
• communications you send through forms, email, or other support channels;
• preferences associated with your account;
• fraud-prevention, transaction, and security information.

Payment information is entered with and processed by our payment providers. POLYGLOT does not store full payment-card numbers unless expressly stated at the time of collection.

3.2 Client-portal data

When you use the POLYGLOT client portal, we may collect and process:

• your name and email address;
• your account role and client organization;
• authentication and account-security information;
• project records;
• quotations and quotation acceptance records;
• uploaded files and submitted materials;
• approvals;
• revision requests;
• comments and project communications;
• download records;
• delivery and acceptance history;
• dates and times associated with portal actions;
• IP address, browser, device, and security information associated with certain actions.

We use these records to provide the service, maintain an accurate project history, enforce access permissions, protect accounts, and demonstrate actions such as approvals, acceptances, and downloads.

3.3 Information collected automatically

When you visit our website or use our services, we may automatically collect:

• IP address;
• device type;
• browser type and version;
• operating-system information;
• pages and features visited;
• date and time of access;
• referring and destination pages;
• session and authentication information;
• approximate location derived from technical information;
• diagnostic, performance, and security events;
• cookie and similar-technology identifiers.

We use this information to operate, secure, measure, and improve our services.

4. Instagram and Meta Platform Data

4.1 Connecting an Instagram account

POLYGLOT allows an Instagram Business or Creator account to be connected through Instagram Login.

The Instagram account owner or an authorized representative chooses whether to grant POLYGLOT access. POLYGLOT does not ask for or store the Instagram account password. Authentication and permission approval take place through Instagram’s authorization service.

POLYGLOT currently requests the following Instagram permissions:

• instagram_business_basic, used to identify and access the connected Instagram professional account and its available media information; and
• instagram_business_manage_insights, used to retrieve account and media analytics made available for the connected professional account.

POLYGLOT does not currently request Instagram permissions to:

• publish content;
• send or read direct messages;
• manage comments;
• manage advertising;
• access a Facebook Page for this connection flow.

4.2 Instagram data we may collect

After authorization, we may collect and process information made available for the connected professional account, including:

Profile information

• Instagram-scoped account identifier;
• username;
• account or display name;
• profile picture;
• account type;
• biography or profile metadata where available;
• follower count;
• following count;
• media count;
• connection and authorization status.

Content information

• posts;
• carousels;
• videos;
• Reels;
• Stories;
• captions;
• media type and product type;
• publication date and time;
• media links and permalinks;
• previews and thumbnails;
• lifecycle or availability state;
• selected account and organization association.

Account and media insights

Depending on availability from Instagram, this may include:

• reach;
• views;
• likes;
• comments;
• shares;
• saves;
• replies;
• total interactions;
• engagement-related values;
• follower and non-follower breakdowns;
• media-product breakdowns;
• profile and follower metrics;
• other account, Content, or Story measurements provided through the authorized connection.

Instagram data may be delayed, unavailable, incomplete, or subject to eligibility requirements determined by Instagram. POLYGLOT presents missing information as missing and does not intentionally substitute a missing measurement with zero.

Audience information

Where made available by Instagram, we may process aggregated audience breakdowns such as:

• country;
• city;
• age range;
• gender;
• follower-activity information.

These values are aggregated information provided by Instagram. POLYGLOT does not receive the identity of individual followers through these aggregated audience breakdowns.

Connection and synchronization information

We may also process:

• encrypted access credentials;
• granted permissions;
• token issue and expiry information;
• account-connection records;
• authorization errors;
• synchronization history;
• data-collection status;
• diagnostic and security records.

Access credentials are stored in protected form and are used only to maintain the authorized connection and make permitted requests.

4.3 How we use Instagram data

We use Instagram data to:

• establish and maintain an authorized Instagram professional-account connection;
• synchronize data made available by Instagram;
• display account-performance dashboards;
• display Content and Story performance;
• calculate period comparisons and reporting values;
• provide audience analytics where available;
• generate PDF and Excel reports;
• issue numbered formal social media reports where requested;
• provide reporting services to the organization associated with the connected account;
• detect missing, delayed, incomplete, or provisional data;
• maintain connection and synchronization health;
• investigate errors and support requests;
• protect account access and prevent unauthorized use.

At present, direct access to POLYGLOT’s Instagram analytics administration pages is limited to authorized POLYGLOT staff providing services to the relevant client organization. POLYGLOT may provide agreed reports and deliverables to authorized client representatives through appropriate service channels.

4.4 Deterministic insights and suggested actions

POLYGLOT may use the connected account’s analytics to generate deterministic, rule-based observations and suggested actions for authorized POLYGLOT staff.

These observations are:

• derived from the connected account’s own data;
• based on predefined rules, evidence standards, and thresholds;
• suppressed when there is not enough qualifying evidence;
• not based on cross-client benchmarks;
• not predictions or guarantees;
• not automatically published to clients.

POLYGLOT does not currently use an external artificial-intelligence or large-language-model service to generate these observations or suggested actions.

Authorized staff may acknowledge, hide, or otherwise review qualifying observations according to POLYGLOT’s internal processes. Review decisions do not change the underlying Instagram data.

4.5 What we do not do with Instagram data

POLYGLOT does not:

• sell Instagram data;
• use Instagram data to identify individual followers from aggregate audience information;
• use Instagram data to create advertising profiles of individual followers;
• combine client accounts to create cross-client performance benchmarks;
• use one client organization’s Instagram analytics for another client organization;
• publish content through the current analytics integration;
• send or read Instagram direct messages through the current analytics integration;
• manage Instagram comments through the current analytics integration;
• represent observations or suggested actions as guaranteed outcomes.

POLYGLOT may process account and media metadata made available through the authorized professional-account connection where needed to provide analytics, reporting, security, and support.

5. How we use personal data

We may use personal data to:

• create and administer accounts;
• authenticate users;
• provide requested products and services;
• process purchases, orders, and payments;
• prepare and manage quotations;
• deliver client projects;
• operate the client portal;
• process approvals and revision requests;
• provide Instagram analytics and reporting;
• communicate about an account, purchase, project, quotation, report, or request;
• respond to questions and support requests;
• verify identity and authority;
• manage client relationships;
• maintain business and accounting records;
• secure our systems and prevent misuse;
• investigate suspected fraud, abuse, unauthorized access, or security incidents;
• diagnose and improve service reliability;
• understand how our website and services are used;
• comply with legal, regulatory, contractual, and record-keeping obligations;
• establish, exercise, or defend legal rights.

We do not sell personal data.

6. Legal grounds for processing

Depending on the data and context, we process personal data where:

• processing is necessary to perform a contract with you or your organization;
• processing is necessary to take steps at your request before entering into a contract;
• you have provided consent;
• processing is necessary to comply with a legal obligation;
• processing is necessary for POLYGLOT’s legitimate interests in operating, securing, improving, and administering the business, where those interests are not overridden by applicable rights;
• processing is necessary to establish, exercise, or defend legal claims;
• another lawful ground applies under applicable law.

For Instagram connections, authorization is initiated by the Instagram account owner or an authorized representative. Consent or authorization may be withdrawn by disconnecting the account, removing POLYGLOT’s access through Instagram, or contacting POLYGLOT.

Withdrawal doesn’t affect processing that was lawful before withdrawal and doesn’t necessarily require deletion of records that POLYGLOT is required or permitted to retain.

7. How we share personal data

We may share personal data only where reasonably necessary for the purposes described in this Privacy Policy.

7.1 Authorized client-organization members

Client-portal information may be available to authorized members of the relevant client organization according to their assigned roles and permissions.

7.2 Service providers

We may use service providers that process information on our behalf, including providers of:

• website and application hosting;
• cloud infrastructure;
• private object and file storage, including Backblaze B2;
• email delivery;
• payment processing;
• website analytics, including Google Analytics where enabled;
• security, monitoring, and technical support;
• backups;
• Microsoft 365 and business-productivity services;
• professional legal, accounting, or advisory services.

Service providers may process data only for the contracted services and permitted purposes, subject to appropriate confidentiality, security, and data-protection obligations.

7.3 Legal and protective disclosures

We may disclose information where reasonably necessary to:

• comply with applicable law or a lawful request;
• respond to a court, regulator, or competent public authority;
• enforce contractual terms;
• protect POLYGLOT, our clients, or other persons;
• investigate fraud, misuse, security incidents, or unlawful activity;
• establish, exercise, or defend legal rights.

7.4 Business changes

If POLYGLOT is involved in a restructuring, merger, acquisition, financing, sale, or transfer of part of the business, relevant information may be disclosed under appropriate confidentiality and legal safeguards.

8. International data transfers

Some service providers may process or store personal data outside Bahrain.

Where personal data is transferred internationally, POLYGLOT takes steps intended to ensure that the information remains protected and applies the safeguards and legal mechanisms required by applicable data-protection law.

We limit service providers to processing personal data for contracted services, documented purposes, and applicable legal obligations.

9. Data security

POLYGLOT uses reasonable technical and organizational measures appropriate to the nature of the information and the risks of processing.

These measures may include:

• encrypted HTTPS connections;
• encryption or protected storage for Instagram access credentials;
• role-based access controls;
• account and organization isolation;
• staff-only access to administrative analytics;
• private file and report storage;
• time-limited authorized download access where used;
• password hashing;
• access logging and security monitoring;
• data validation;
• backups;
• testing and controlled release processes;
• incident-investigation procedures.

No method of transmission, processing, or storage is completely secure. POLYGLOT therefore cannot guarantee absolute security, but we work to protect personal data and respond appropriately to suspected security incidents.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including service delivery, client relationships, security, record-keeping, dispute resolution, and legal or contractual obligations.

Retention depends on the type of information and the context.

10.1 Website and account information

Account information may be retained while the account remains active and for a reasonable period afterward where needed for security, support, legal, contractual, or record-keeping purposes.

Eligible information may be deleted or anonymized following account closure, subject to information that POLYGLOT is required or permitted to retain.

10.2 Orders, quotations, invoices, and payments

Order, quotation, invoice, transaction, and payment records may be retained for the periods required by accounting, tax, contractual, audit, and legal obligations.

10.3 Client-portal and project records

Project records may be retained during the client relationship and afterward where needed to maintain an accurate record of:

• instructions;
• deliverables;
• approvals;
• revision requests;
• quotation acceptances;
• downloads;
• intellectual-property permissions;
• disputes;
• financial and contractual obligations.

10.4 Instagram credentials

Instagram access credentials are retained only while needed to maintain the authorized connection.

When an Instagram account is disconnected, POLYGLOT deletes or disables the stored access credential and stops collecting new Instagram data for the account.

10.5 Historical Instagram analytics

Disconnecting an Instagram account doesn’t necessarily delete information previously collected through the authorized connection.

Previously collected analytics, synchronization records, dashboards, reports, and supporting operational records may be retained:

• during the client relationship;
• to provide agreed reporting;
• to maintain accurate business and service records;
• for security and audit;
• to resolve disputes;
• to satisfy contractual, legal, or regulatory obligations.

Account owners and authorized representatives may request deletion through our Data Deletion Instructions. POLYGLOT will delete or anonymize eligible information, subject to records that POLYGLOT is required or permitted to retain.

10.6 Formal issued reports

Where a formal numbered report is issued, POLYGLOT may retain:

• the issued report;
• its frozen reporting dataset;
• associated PDF and Excel artifacts;
• supporting metadata;
• issuance and download records;
• relevant audit information.

Issued formal reports are intended to provide a durable record and are not silently changed after issuance.

If a correction is required, POLYGLOT may issue a new report while retaining the earlier record where necessary for contractual, legal, audit, security, or record-keeping purposes.

10.7 Staff insight-review records

POLYGLOT may retain staff review decisions and associated internal notes relating to deterministic insights for security, audit, workflow, and quality-assurance purposes.

These records are staff-only and aren’t automatically included in client reports.

10.8 Backups and logs

Information may remain temporarily in protected backups until those backups are overwritten or expire under the applicable backup lifecycle.

Security and operational logs are retained only as long as reasonably necessary for monitoring, investigation, troubleshooting, and legal requirements.

11. Disconnecting Instagram and requesting deletion

An Instagram account owner or authorized representative may disconnect POLYGLOT at any time.

Disconnecting:

• removes or disables POLYGLOT’s stored access credential;
• ends new Instagram data collection;
• doesn’t necessarily delete previously collected analytics, reports, or records;
• doesn’t itself delete the Instagram account;
• doesn’t remove information stored independently by Instagram.

The account owner may also remove POLYGLOT’s authorization through the connected-app or website controls made available by Instagram or Meta.

To request deletion of eligible data held by POLYGLOT, follow the process on our Data Deletion Instructions page or email info@polyglotdesign.com.

We may ask for information reasonably necessary to:

• verify the requester’s identity;
• verify authority over the relevant account or organization;
• identify the information covered by the request;
• protect information belonging to another person or organization.

We will explain if certain information cannot be deleted because it must or may be retained for legal, contractual, security, audit, dispute-resolution, or record-keeping purposes.

12. Your rights and choices

Subject to applicable law and relevant exceptions, you may have the right to:

• request information about how personal data is processed;
• access personal data held about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of eligible personal data;
• object to or request restriction of certain processing;
• withdraw consent where processing relies on consent;
• complain about how personal data is handled.

To submit a request, email info@polyglotdesign.com.

We may need to verify your identity or authority before completing a request. We may also ask for clarification where necessary to identify the relevant information.

Store customers

Store customers may manage available account information through the POLYGLOT Profile Page.

Closing an account doesn’t necessarily delete order, invoice, payment, contractual, fraud-prevention, security, or legal records that POLYGLOT is required or permitted to retain.

Instagram professional-account owners

Instagram professional-account owners or authorized representatives may:

• disconnect the account;
• remove POLYGLOT’s Instagram authorization;
• request deletion of eligible information held by POLYGLOT.

Instructions are available on our Data Deletion Instructions page.

Complaints

If you aren’t satisfied with our response, you may have the right to submit a complaint to the Personal Data Protection Authority in the Kingdom of Bahrain.

Information about the authority is available from the Bahrain Personal Data Protection Authority.

13. Cookies and similar technologies

POLYGLOT may use cookies and similar technologies for:

• account authentication;
• session management;
• shopping-cart functionality;
• security;
• remembering preferences;
• service performance;
• website analytics.

Essential cookies support functions such as sign-in, security, and the shopping cart.

Where required, non-essential analytics cookies are used according to the cookie choices provided through the website. You can also block or delete cookies through your browser settings, although some features may not function correctly without essential cookies.

Where Google Analytics is enabled, Google may process information such as pages visited, device and browser information, approximate location, and usage events according to the applicable configuration and Google’s own terms.

14. Third-party services and links

Our services may contain links to external websites and services, including Instagram, Meta, payment providers, media platforms, and other third parties.

Those third parties operate under their own privacy policies and terms. POLYGLOT isn’t responsible for the privacy practices of independent third parties.

We recommend reviewing their policies before submitting personal data or using their services.

15. Children’s privacy

POLYGLOT’s services aren’t directed to children under 13, and we don’t knowingly collect personal data directly from children under 13.

If you believe a child has provided personal data to POLYGLOT without appropriate authorization, contact info@polyglotdesign.com so we can investigate and take appropriate action.

Certain services may be intended only for adults or persons legally able to enter into contracts. Additional age requirements may apply depending on the service and jurisdiction.

16. Automated decision-making

POLYGLOT doesn’t use the current Instagram analytics service to make solely automated decisions that produce legal or similarly significant effects concerning individuals.

Deterministic analytics observations and suggested actions are staff-support tools. They are based on predefined rules and are subject to human review.

17. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• changes to our services;
• changes to technology;
• changes to our data practices;
• legal or regulatory requirements;
• security or operational improvements.

The latest version will be published on this page with an updated “Last updated” date.

Where appropriate, we may provide additional notice of material changes.

18. Contact POLYGLOT DESIGN

For privacy questions, requests, or complaints, contact:

POLYGLOT DESIGN™
Kingdom of Bahrain
Email: info@polyglotdesign.com
Website: POLYGLOT DESIGN